diff --git a/.forgejo/workflows/build-apk.yml b/.forgejo/workflows/build-apk.yml
index 9a8df34..3f3fd2b 100644
--- a/.forgejo/workflows/build-apk.yml
+++ b/.forgejo/workflows/build-apk.yml
@@ -85,10 +85,25 @@ jobs:
           fi
           export PATH="$ANDROID_HOME/cmdline-tools/latest/bin:$PATH"
           yes | sdkmanager --licenses >/dev/null 2>&1 || true
-          # sdkmanager is a no-op for packages already present in the volume.
+          # Self-heal a corrupt/incomplete NDK or CMake left by a failed run
+          # (AGP's auto-installer sometimes leaves a truncated archive -> the
+          # "Archive is not a ZIP archive" failure). A valid package always has
+          # a source.properties; if it's missing, wipe the dir so sdkmanager
+          # reinstalls cleanly.
+          NDK_VER=27.1.12297006
+          CMAKE_VER=3.22.1
+          for p in "ndk/$NDK_VER" "cmake/$CMAKE_VER"; do
+            if [ -d "$ANDROID_HOME/$p" ] && [ ! -f "$ANDROID_HOME/$p/source.properties" ]; then
+              echo "Removing incomplete $p"; rm -rf "$ANDROID_HOME/$p"
+            fi
+          done
+          # Install everything (incl. NDK + CMake) via sdkmanager, which is
+          # checksum-verified and robust — instead of letting Gradle/AGP auto-
+          # download the NDK mid-build. No-op for packages already valid.
           sdkmanager --install "platform-tools" \
             "platforms;android-36" "platforms;android-35" \
-            "build-tools;36.0.0" "build-tools;35.0.0" >/dev/null
+            "build-tools;36.0.0" "build-tools;35.0.0" \
+            "ndk;$NDK_VER" "cmake;$CMAKE_VER" >/dev/null
           echo "$ANDROID_HOME/platform-tools" >> "$GITHUB_PATH"
           echo "$ANDROID_HOME/cmdline-tools/latest/bin" >> "$GITHUB_PATH"